Edition Differences
CBH provides two editions: Standard and Professional. This section describes the differences between the editions. You can select an edition based on your service requirements.
Instance Editions and Specifications
| Edition | Function Description | Edition Specifications |
|---|---|---|
| Standard edition | Basic functions: identity authentication, permission control, account management, and operation audit |
|
| Professional edition | Basic functions: identity authentication, permission control, account management, and operation audit Enhanced functions: cloud service O&M, automated O&M, and database O&M audits |
|
Specification Configuration
The number for each asset quantity scale in Max. Concurrent Connections in Table 2 is based on the concurrent connections of character protocol clients (such as the SSH client and MySQL client). The number of concurrent connections for graphical protocols (such as HTML5 web-based O&M and RDP client O&M) largely depends on factors like the resolution, color depth, and image dynamics. According to lab test results, the number of concurrent connections for graphical protocols is only 1/10 to 1/3 of that for character protocols.
| Asset Quantity | Max. Concurrent Connections (Based on Character Protocol) | CPUs | Memory | System Disk | Data Disk |
|---|---|---|---|---|---|
| 50 | 50 | 4 vCPUs | 8 GB | 100 GB | 500 GB |
| 100 | 100 | 4 vCPUs | 8 GB | 100 GB | 1,000 GB |
| 200 | 200 | 4 vCPUs | 8 GB | 100 GB | 1,000 GB |
| 500 | 500 | 8 vCPUs | 16 GB | 100 GB | 2,000 GB |
| 1,000 | 1,000 | 8 vCPUs | 16 GB | 100 GB | 2,000 GB |
| 2,000 | 1,500 | 8 vCPUs | 16 GB | 100 GB | 2,000 GB |
| 5,000 | 2,000 | 16 vCPUs | 32 GB | 100 GB | 3,000 GB |
Function Details and Edition Differences
Both the standard edition and professional edition provide basic functions such as identity authentication, permission control, account management, and operation audit. The main differences between the two editions lie in the enhanced functions of automated O&M and database O&M audit.
For details about the differences between the editions, see Table 3.
| Function Module | Function | Description | Standard Edition | Professional Edition |
|---|---|---|---|---|
| Profile | Basic Info | You can view details about the current login user and change the name, phone number, email address, and password. | Supported | Supported |
| Mobile OTP | You can get guidance for binding a mobile phone token and generating a dynamic password. | Supported | Supported | |
| SSH Pubkey | You can view information about all public keys, and add and manage SSH public keys. | Supported | Supported | |
| My Permission | You can view the permissions the logged-in user has. | Supported | Supported | |
| My Log | You can check logs of instance logins, operations, and resource logins by the logged-in user. | Supported | Supported | |
| Basic system information | Dashboard | The dashboard displays the running status of the bastion host, including sessions, tickets, login status, operation status, host types, application types, and system status. | Supported | Supported |
| Download Center | You can download some remote login tools and local player tools. | Supported | Supported | |
| Messages | After alarm rules are configured, an alarm is generated when an alarm rule is triggered. | Supported | Supported | |
| System | This area displays system details, such as the system ID, credential, version in use, and release date. You can also update credentials and HA keys and obtain service codes in this module. | Supported | Supported | |
| Authentication management | MFA | You can log in to the bastion host using an account (username and password), mobile phone token, SMS message, USB key, OTP token, or email.
| Supported | Supported |
| Remote authentication | You can configure remote authentication to use CBH centrally manage all accounts. CBH also allows you to authenticate user identities through AD, RADIUS, LDAP, Azure AD, and SAML remote authentication. | Supported | Supported | |
| System accounts | User management | You can create, import, export, and delete accounts, configure user groups, and manage account login restrictions. | Supported | Supported |
| User group management | Users can be managed by group. You can assign permissions to all users in a group at a time. You can create, delete, and edit a user group. | Supported | Supported | |
| Role management | You can associate users with roles and assign operation and access permissions to the roles, including department administrators, policy administrators, audit administrators, and O&M engineers. Only the admin account can add roles and modify the permissions of the roles. | Supported | Supported | |
| Resource account management | A resource account is used to log in to a resource managed by a bastion host instance. Multiple resource accounts can be created for a resource. The username and password of a resource account in CBH must be the same as those of the original account that the resource belongs to. Otherwise, the logins to the resource may fail, and no operations can be done for the resource through the bastion host. | Supported | Supported | |
| Resource account group management | You can manage resource accounts by group. You can authorize and verify resource accounts in batches by authorizing account groups. You can create, delete, and maintain account groups and manage account group information. | Supported | Supported | |
| Resource | Host resource management | You can add host resources to a bastion host by creating, automatically discovering, importing, or cloning host resources. You can view details about all host resources and manage them through the bastion host centrally. | Supported | Supported |
| Application resource management | You can import and create application resources through an application server. Then, you can view details about all application resources and manage them through the bastion host centrally. Note that you need to create the application server first. | Supported | Supported | |
| Cloud resource management | You can import and create application resources through a Kubernetes server. Then, you can view details about all container resources and manage them through the bastion host centrally. Note that you need to create the Kubernetes server first. | Not supported | Supported | |
| Resource OS type management | You can add tags to OS types and then group and manage resources by those tags. With OS type tags, you can change server passwords, store password change parameters, and run password rules for resources of a certain OS type at the same time. | Supported | Supported | |
| System policies | ACL rules | This type of rule controls who can access which resources. ACL rules are associated with users or user groups. An ACL rule can restrict file transfer, file management, and login time. ACL rules can also be associated with resource accounts. | Supported | Supported |
| Command rules |
| Supported | Supported | |
| Database control rules |
| Not supported | Supported | |
| Password rules | This type of rule is associated with resource accounts of hosts, so that a user can change passwords of resource accounts associated with a policy at the same time. | Supported | Supported | |
| Account synchronization rules | This type of rule helps synchronize host resource account details. Synchronization rules are associated with resource accounts. You can execute a synchronization rule to synchronize details of all resource accounts the rule is associated with at the same time. | Not supported | Supported | |
| Resource operation | Host resource operation | You can log in to host resources through browsers and clients and perform operations such as operation session sharing, file transfer, file management, and preset commands. | Supported | Supported |
| Application resource operation | You can log in to application resources using a browser and perform operations such as operation session sharing, file transfer, and file management. | Supported | Supported | |
| Cloud service resource operation | You can log in to container resources using a browser and perform operations, including operation session sharing. | Not supported | Supported | |
| Operation script management | You can import and edit scripts to be executed on the bastion host to complete complex or repetitive tasks, improving efficiency. | Not supported | Supported | |
| Fast operation | You can directly run preset commands and scripts and transfer files on the bastion host for quick resource operation. Logs of all operations are provided. | Not supported | Supported | |
| Operation task management | You can customize manual, scheduled, or scheduled operation tasks for commands, scripts, and file transfer. All task operation logs are provided. | Not supported | Supported | |
| System audit | Live session audit | All ongoing sessions are logged. You can view the resource, type, account, and source IP address of any session. | Supported | Supported |
| Historical session audit | All closed historical sessions are logged. You can view the resource, type, account, and source IP address of any session. | Supported | Supported | |
| System log audit | All logins to and operations on the bastion host are logged in detail. You can check who logged in to the system over which IP address at which time, as well as what specific functions and operations are performed after each login. | Supported | Supported | |
| Operation report audit | An operation report collects statistics on the operation time, the number of resource access times, how long the session lasts, source IP address access status, session collaboration, two-person authorization, command interception, number of character commands, and number of transferred files by time, user, and resource. | Supported | Supported | |
| System report audit | A system report collects statistics on system operation control, resource operation, source IP addresses, login mode, abnormal logins, sessions, and status. | Supported | Supported | |
| Ticket | ACL tickets | If you do not have the permission to access a resource, you can submit a ticket to apply for the permissions. Such permissions include file transfer, file management, keyboard audit. This type of permission is valid to a specific resource account in a fixed time range. | Supported | Supported |
| Command control ticket management | If you do not have the permission to run commands to operate a certain resource, you can submit a ticket to apply for the permission for the resource. This type of permission is valid to a specific resource account in a fixed time range. | Supported | Supported | |
| Database ticket management | If you do not have the permission to perform operations on a database resource, you can submit a ticket to apply for the permission. This type of permission is valid to a specific resource account in a fixed time range. | Not supported | Supported | |
| Ticket approval management | This page displays details about all tickets. You can review tickets on this page. | Supported | Supported | |
| Ticket configuration | You can customize the scope, submission method, effective time, and approval process of a ticket. | Supported | Supported | |
| System configuration | Security | You can configure the maximum incorrect password attempts, zombie users, password change period, login timeout, certificate, proxy security layer, mobile phone token, USB key, inspection, expiration notification, and session restriction. | Supported | Supported |
| Network | You can view the network interface list, DNS, and default gateway details of the bastion host, and configure static routes. | Supported | Supported | |
| HA | If the bastion host is deployed in primary/standby mode, you can enable or disable HA. | Supported | Supported | |
| Port | You can check the default port for operations and the console. You can also change the port if needed, which is not recommended. | Supported | Supported | |
| Outgoing | You can configure the way to send alarms. Currently, email, SMS, and LTS are supported. After the LTS agent is installed, LTS can send bastion host logs to the server. | Supported | Supported | |
| Alarm | You can configure the alarm mode and level for different message types, including the login status, user operations, resource operation events, and operation activities. | Supported | Supported | |
| Theme | The default logo of the bastion host can be customized. | Supported | Supported | |
| Bastion host system maintenance | Data storage maintenance | You can view the usage of the system and data disks, modify the web disk space, customize the log storage period, and delete logs automatically or manually. | Supported | Supported |
| Log backup | You can back up logs to a local PC, OBS server, syslog server, or FTP/SFTP server. | Supported | Supported | |
| System maintenance | You can view the status of the system, customize the system address and time, back up and restore the operating system, view the authorization information, and diagnose the network and system. | Supported | Supported |
